Your defense team includes a former Qlarant auditor now-attorney who knows exactly what these UPICs look for and their weaknesses. We will help you understand why you are being targeted and how to fight audit error and recoupment demands.
We Stop Enforcement Overreach at Every Stage
RAC or UPIC records request response
UPIC payment suspension rebuttal
UPIC enrollment revocation and preclusion
Redetermination of CMS's overpayment demand
Reconsideration by a Qualified Independent Contractor
Did Qlarant, SafeGuard Services, CoventBridge, or Another UPIC Contact You?
What looks like a request for medical records may be part of a larger Medicare program-integrity investigation. What you produce—and what you say—can shape what happens next.
Before responding, understand what the contractor is examining, where the vulnerabilities are, and how to protect the practice.
If your organization has received a UPIC additional documentation request (ADR), a prepayment-review notice, or a demand arising from a UPIC investigation, the value of early review is not simply having a lawyer send the records. It is having the legal, clinical, and program-integrity questions addressed together before the contractor’s first conclusion hardens into the framework for everything that follows.
Health Law Alliance defends providers nationwide from the first records request through payment suspension, extrapolated overpayment, Medicare appeal, and any related government investigation. Our defense team includes licensed clinician-attorneys who understand both the practice of medicine and applicable law, former Medicare investigators, and aggressive big-firm litigators with specialized healthcare backgrounds.
“A UPIC document request is anything but routine. Providers should not miss an opportunity to shape the audit from the outset.”
Brian O’Loughlin · Former healthcare fraud investigator for Qlarant and registered nurse.
Use this first-response guide to structure legal, clinical, and program-integrity review before anything leaves your organization.
01
Why the first response is critical
Providers often assume that anything missed at the audit stage can be corrected on appeal. That overstates what the later levels can fix. Untimely or incomplete production can produce technical denials that the contractor then samples and, if the statutory predicates exist, extrapolates. New evidence can still be submitted at redetermination and at QIC reconsideration. After the QIC decision, 42 U.S.C. § 1395ff(b)(3) generally bars a provider from introducing evidence that was not presented at that reconsideration. A misstep at any stage in the process can doom the audit or appeal.
Medicare’s claims appeal process has five levels
Redetermination by the MAC
Reconsideration by a Qualified Independent Contractor
Hearing before an Administrative Law Judge
Review by the Medicare Appeals Council
Judicial review in federal district court
02
Is it an audit or something more?
A UPIC’s review can include medical-record review, non-medical record review, site visits, provider and beneficiary interviews, referrals for payment suspension, and recommendations for further administrative or enforcement action. Thus, the same information that goes into a UPIC’s audit and any recoupment demand may also be used to support more significant investigations and accusations.
Even if the UPIC’s review appears to be an audit and nothing more sinister, it is important for providers to respond in a manner designed to rebut any fraud, waste or abuse (FWA) concerns. Leave nothing to chance.
03
Loose lips sink ships
UPIC investigators, many of them former law enforcement, are trained to elicit information from providers that they can then use against them. In addition, there is a natural tendency to attempt to explain things to people who appear confused or lack a full understanding, as UPIC auditors often imitate.
Do not fall for this audit trap. The more you attempt to talk yourself out of the audit, the more it can backfire. Among other things, you can be accused of lying to the auditor, even based on nothing more than a misinterpretation or misunderstanding. Attorneys insulate providers from any such allegations.
04
Do not underestimate the consequences of deadlines
Many UPIC medical-record requests provide a 30-calendar-day response period, but the controlling deadline is the one stated in the actual request and the governing authority. Do not rely on a remembered “standard” deadline. Date-stamp the letter, confirm when it was received, and work backward from the stated due date so that legal and clinical review happens before the production deadline rather than on it.
To be crystal clear: Where records are not timely produced, the contractor may deny the sampled claims outright for lack of supporting documentation and then extrapolate that denial rate across the population.
05
Understand what can and cannot be “fixed”
A well-intentioned effort to “fix” a chart creates a second problem on top of the first—and the second one can create worse problems. Authentication is different from supplementation, and supplementation is different from rewriting history.
Before changing or adding anything after receipt of the request, determine what the applicable CMS rule actually permits and preserve the original entry. There may be an opportunity to “paper-over” some errors or omissions, but strict rules apply.
06
Provide only what is required, nothing more
One of the most common mistakes is treating the response as an export function: pull the EHR, upload hundreds or thousands of pages, and assume the reviewer will find the important evidence. However, a defensible claim can still be denied when the supporting evidence is buried, disconnected, or never tied to the coverage requirement being tested. Even worse, once you turn over a record, it can be used by the UPIC for any purpose, including to initiate new audits or recoupment demands.
If you do not have the time to carefully select and produce the records that support your billing, seek assistance from an attorney-clinician with the necessary experience and background.
07
Make it easy for the auditor
UPIC investigators often are not clinicians and may not even have much experience in healthcare. To the extent that an auditor does not understand what he or she is looking at, that frustration alone can result in adverse findings. Accordingly, it is important to organize your response in a manner that assists the auditor where helpful to your case.
A defensible production typically includes
A transmittal letter identifying the request, production date, beneficiaries, and enclosed materials
A beneficiary-by-beneficiary index
Consistent pagination or Bates numbering
Records arranged chronologically or by service date
Clear separation between contemporaneous clinical records and later-created explanatory materials
A concise coverage map identifying where each required element appears in the record
Appropriate labeling of signature logs, attestations, late entries, and addenda
08
Know the legal standards, not just medical standards
Medicare coverage rules change. An LCD, article, or manual provision in force today may not have applied when the service was furnished. A provider cannot evaluate the claim fairly or identify an incorrect retroactive policy application without first determining what rule actually governed on that date.
Pulling the correct historical policy is a small amount of work at the outset that can dispose of entire categories of denials later.
09
Extrapolation may be a hoax
Extrapolation is what turns a modest sample-level finding into a devastating recoupment demand. Providers often treat it as inevitable. It is not.
Even where permitted by statute, the methodology itself remains contestable. Sampling and extrapolation must follow the requirements of the Medicare Program Integrity Manual. The sample must be a probability sample in which each sampling unit has a known probability of selection. Challenges commonly focus on whether the sampling units were properly defined and independent, whether the random selection process was adequately documented and replicable, and whether the statistical assumptions underlying the point estimate and confidence interval hold.
Questions worth asking as soon as the request arrives
How many claims were requested, and over what span of dates of service?
Has the contractor identified a basis for a sustained or high level of payment error (or prior failed educational intervention)?
Was there a prior educational intervention, TPE episode, or probe review?
Has the provider requested the sampling frame, the universe definition, the random-number documentation (or alternative replication method), and the full methodology documentation?
10
Control communications and assess what comes next
Designate one point of contact, preferably counsel or a trained compliance leader, and route organizational communications through that person. Maintain a contemporaneous log of every contact: date, participants, topic, documents requested, what was said, and any follow-up commitment.
The initial response should also prompt a broader risk assessment
Is the sample consistent with a potential extrapolation?
Is the requested population tied to a known outlier pattern, complaint, prior TPE history, or referral?
Are records held by third parties, referring clinicians, billing vendors, or separate business units?
Could payment suspension or prepayment review create an immediate cash-flow issue?
Has the organization independently identified any potential overpayment requiring further analysis?
Are there facts suggesting the need for separate individual counsel, a privileged internal investigation, or a heightened enforcement posture?
If you need assistance working through any of these questions, the attorneys at Health Law Alliance have the experience and background necessary to guide the response. We offer flexible fee arrangements and competitive rates.
Do Not Respond without a Plan
Our attorneys will guide your response from beginning to end, using the law and medical standards to defeat arbitrary audit clawbacks.
UPIC findings cluster around a predictable set of documentation and billing issues. Knowing which one the contractor is building toward shapes the response, because the record you produce at the document request stage is the record you argue from through every level of appeal.
Where Our Attorneys Served Before Health Law Alliance
Department of Justice
Agency and company marks identify former professional experience of individual HLA team members. They do not imply affiliation, endorsement, or a client relationship.
Recent UPIC Defense Outcomes
Representative Case Results
Outcomes are summarized for confidentiality. Client names, precise geography, and identifying facts are redacted.
Recoupment Reversed
Statistical Extrapolation Challenge Reduces UPIC Demand by Substantial Margin
Provider received a UPIC postpayment review finding with statistical extrapolation across a multi-year claim window. Health Law Alliance challenged the contractor's sample frame, sample size methodology, and RAT-STATS application errors at the redetermination and QIC reconsideration stages. The extrapolated recoupment demand was reduced to the actual sample-claim amount, a small fraction of the original number. The procedural record built at the redetermination level supported the QIC's reduction without requiring an ALJ hearing.
Federal · Healthcare provider · 2024
DOJ Declination
DOJ Declines Civil and Criminal Action After UPIC Referral
Healthcare company received a UPIC referral that produced a Civil Investigative Demand from the DOJ Civil Division covering alleged $6M in false claims. Health Law Alliance produced documents under a negotiated rolling schedule, presented the factual rebuttal of the government's theory in a meeting with the line attorneys, and prepared a written submission addressing the materiality and falsity defects. DOJ declined both civil intervention and criminal referral. Pre-unsealing engagement, when the matter surfaces through other channels, is the highest-leverage window in any FCA matter.
National scope · Healthcare company · 2024
Indictment Dismissed
Federal Healthcare Fraud Indictment Following UPIC Referral Collapses
Solo physician faced a multi-count federal indictment that included healthcare fraud counts following an upstream UPIC referral to the local U.S. Attorney. Health Law Alliance filed responsive motions, built the procedural record, and challenged the government's theory through pre-trial motion practice; the indictment collapsed before trial. The UPIC-to-criminal escalation risk is real in matters where the contractor's findings include intent evidence; a unified defense across the UPIC appeal track and the parallel criminal track is the most efficient way to avoid the criminal exposure.
Northeast · Solo physician · 2025
Attorney advertising. Prior results do not guarantee a similar outcome. Case summaries are generalized for confidentiality and are not a substitute for legal advice on your specific matter.
The HLA Team
HLA UPIC Defense Attorneys
UPIC matters can cross Medicare and Medicaid appeals, licensing and regulatory enforcement, False Claims Act exposure, and criminal referrals. Health Law Alliance handles the audit response and any parallel appeal or referral as one coordinated matter.
Common UPIC Audit Triggers
The six patterns that put a UPIC audit in motion
UPICs use CMS-supplied data analytics to identify providers whose billing patterns deviate from peer comparables. The following triggers are the most common predicates for a UPIC document request, prepayment review notice, or focused medical review.
01
Data analytics flags from peer comparator analysis.
CMS provides UPICs with claims data and peer comparator analytics. Providers whose billing patterns fall in the top decile of their peer group on a specific code, code combination, or modifier usage face elevated UPIC review frequency. Common high-risk patterns include high E/M code distribution (CPT 99214 and 99215 over 80% of visits), high modifier 25 utilization, high modifier 59 utilization, and outlier reimbursement per beneficiary on Part B drug administration.
02
Prior contractor findings (RAC, MAC, SMRC, CERT).
A RAC overpayment determination, a MAC medical review with high error rate, an SMRC focused review with adverse findings, or a CERT (Comprehensive Error Rate Testing) sample finding can produce a downstream UPIC review. The UPIC inherits the prior contractor's findings as the starting point for its own review and can expand the scope materially. Providers who have closed a prior contractor matter without a clean record should anticipate the UPIC follow-up.
03
Specialty-specific enforcement initiatives.
UPICs run focused enforcement initiatives targeted at specific specialties or service lines. Recent examples include skin substitute applications following the Apex Medical $309M FCA settlement, debridement coding following the Vohra $45M settlement, hospice eligibility review, home health face-to-face documentation, and remote patient monitoring billing. Providers operating in an initiative-targeted area face elevated UPIC review regardless of individual billing patterns.
04
Medicare Drug Integrity Contractor (MEDIC) referral on Part D.
For Part D matters (pharmacies dispensing Medicare prescription drug benefit claims), the Medicare Drug Integrity Contractor identifies suspicious patterns and refers them to the UPIC for parallel medical review. The MEDIC and UPIC tracks coordinate, which means a Part D investigation at the pharmacy level can produce a UPIC review at the prescriber level (or vice versa). Cross-track exposure is common in opioid, GLP-1, and specialty drug dispensing patterns.
05
State Medicaid Fraud Control Unit (MFCU) cross-referral.
State MFCUs investigate Medicaid fraud and refer matters to the UPIC for parallel Medicare review when the provider participates in both programs. The MFCU investigation can produce a UPIC review on the Medicare side that the provider did not anticipate. The state-federal coordination is increasingly tight, and defense counsel that handles only one side often misses procedural exposure on the other.
06
Qui tam relator or whistleblower complaint referral.
A qui tam complaint filed with DOJ under seal can produce a UPIC referral when the DOJ Civil Division wants the UPIC's billing analysis to support the FCA case. Internal whistleblower hotline reports, when escalated outside the company, can produce the same referral pipeline. The UPIC document request that follows often does not identify the underlying relator complaint, but the document scope tracks the relator's allegations closely enough that experienced defense counsel can identify the underlying matter.
UPIC Audit Defense FAQ
Frequently Asked Questions
Eleven questions that come up on almost every first call. The answers below are general; specific situations require privileged consultation.
A UPIC (Unified Program Integrity Contractor) is a CMS contractor responsible for Medicare and Medicaid program integrity work in a specific geographic jurisdiction. CMS established the UPIC program in 2016 to consolidate work that was previously split between Zone Program Integrity Contractors (ZPICs) and Program Safeguard Contractors (PSCs). UPICs are different from Recovery Audit Contractors (RACs), which conduct postpayment review of paid claims for overpayment recovery on a contingency basis; from Medicare Administrative Contractors (MACs), which adjudicate claims and process payments; and from Supplemental Medical Review Contractors (SMRCs), which conduct medical review of specific topics on CMS direction. The procedural framework, the appeal track, and the realistic exposure differ across all four contractor types.
SafeGuard Services covers the Northeast and Southeast regions, while CoventBridge is the Midwest Region UPIC. Qlarant has nationwide authority over FWA analytics for Medicare Part C and Part D through the National Benefit Integrity Medicare Drug Integrity Contract (NBI MEDIC) and the Investigations Medicare Integrity Contract (I-MEDIC). The audit notice itself identifies the contractor, but providers often miss the contractor identification because the notice arrives on CMS letterhead with the contractor name in smaller text. The contractor matters because each UPIC has somewhat different document request conventions, different statistical methodologies, and a different working relationship with the local U.S. Attorney's office. Defense counsel that has worked with the specific contractor on prior matters knows the procedural patterns that an unfamiliar counsel will not.
Prepayment review means the UPIC reviews each claim before CMS pays it. The provider continues to submit claims as usual, but cash flow stops while each claim sits in review (typically 60 to 180 days per claim). Multi-year prepayment review is a possible posture under recent CMS frameworks. Postpayment review means the UPIC reviews claims that have already been paid and demands recoupment of any claims found non-compliant. Postpayment review typically uses statistical extrapolation: the UPIC reviews a sample (often 30 to 50 claims), calculates an error rate, and extrapolates the error rate across the full claim population for the audit window. The procedural defenses, the cash flow consequences, and the ALJ appeal posture differ materially between the two.
Yes. CMS or the state Medicaid agency may suspend payments during a UPIC investigation where there is a credible allegation of fraud, before any liability has been established. A suspension generally runs up to 180 days and can be extended while the investigation continues. The effect arrives immediately: revenue stops while payroll, rent, and inventory obligations continue. Providers have an opportunity to submit a rebuttal statement, and that rebuttal is one of the few early chances to put your account of the billing in front of the contractor before its conclusions harden. Prepayment review reaches a similar cash-flow result by a different route, holding each claim for review rather than suspending payment outright.
An extrapolated overpayment is what happens when a contractor reviews a limited sample of claims, calculates an error rate from that sample, and projects that rate across the entire universe of claims for the audit period. A review of 30 to 50 claims can produce a demand in the millions. Extrapolation is not automatic. Under 42 U.S.C. 1395ddd(f)(3) it requires a determination of a sustained or high level of payment error, or a documented failure of a prior educational intervention. The error determination itself is not subject to review, but the statistical methodology behind the projection is, and that is where most successful challenges are made.
Statistical extrapolation challenges focus on whether the UPIC's methodology meets the CMS Program Integrity Manual standards and the relevant federal court precedent. Common defense angles include sample frame defects (the sample is drawn from a population that does not match the audit scope), sample size deficiencies (the sample is too small to support extrapolation at the cited confidence interval), RAT-STATS application errors (the contractor's use of the CMS-mandated statistical software), and Cochran formula objections (the formula used to calculate the point estimate or the lower confidence bound). A successful extrapolation challenge can reduce a multi-million dollar recoupment demand to the actual sample-claim amount, which is typically a small fraction of the extrapolated number. Statistical defense requires either an in-house defense expert or a retained statistician with healthcare claims experience.
There is no fixed duration. A narrow document request can be resolved in a few months. Matters involving large claim volumes, extrapolation, site visits, beneficiary interviews, or a referral to another agency commonly run a year or more, and the appeal track adds time on top of that: the ALJ level in particular has historically carried a substantial backlog. The audit timeline and the cash-flow timeline are separate problems. A payment suspension or prepayment review can be affecting revenue long before any findings are issued, which is why the response has to address both at once.
The Medicare appeal track has five levels with strict statutory deadlines. Level 1 is the redetermination request to the MAC, due within 120 days of the initial determination. Level 2 is the reconsideration request to a Qualified Independent Contractor (QIC), due within 180 days of the redetermination. Level 3 is the Administrative Law Judge (ALJ) hearing, due within 60 days of the QIC reconsideration; the ALJ hearing has historically had a multi-year backlog, though CMS has worked to reduce it. Level 4 is the Medicare Appeals Council review. Level 5 is federal district court review under 42 USC § 405(g). Missing any deadline waives the appeal at that level and forecloses subsequent levels. The redetermination and reconsideration are the most consequential procedural steps because the record built at those levels is the record the ALJ will review.
UPICs refer matters to HHS-OIG, the DOJ Civil Division, and the local U.S. Attorney's office when the audit findings produce evidence of intent rather than billing errors. Common referral patterns include: documented patterns of false certifications, evidence of services billed but not provided, kickback or anti-kickback indicators, suspected upcoding of E/M or procedure codes for financial gain, and any pattern that the UPIC investigator believes supports a False Claims Act theory. The civil FCA referral runs through the DOJ Civil Division (the matter may surface as a Civil Investigative Demand). The criminal referral runs through the local U.S. Attorney or DOJ Fraud Section (the matter may surface as a federal grand jury subpoena or a target letter). Coordinating the UPIC defense with parallel FCA and criminal defense from the first contact is essential because evidence developed in one track is admissible in the others.
Yes, indirectly but seriously. UPIC findings can be referred to state licensing boards, the DEA, state Medicaid agencies, and Medicare enrollment authorities. A single audit can therefore produce parallel exposure: an overpayment demand, revocation of billing privileges or preclusion, Medicaid termination, a board complaint, and action against a DEA registration where controlled substances are involved. These proceedings run on separate timetables under separate standards, and positions taken in the audit response can carry into all of them. Coordinating the audit response with the licensing and registration exposure from the outset avoids admissions in one forum that become a problem in another.
Before responding to the document request. The UPIC document request letter is the first procedural opportunity in the audit, and the production response shapes everything that follows: which documents the UPIC reviews, what claim universe the sample is drawn from, what the realistic findings range will be, and whether the UPIC sees patterns that escalate to criminal referral. A document production made without privileged counsel can produce material that becomes evidence in subsequent civil and criminal litigation, and the procedural defenses available later (extrapolation challenges, ALJ appeal arguments) can be foreclosed by an inadequate or over-inclusive production. The earlier counsel is engaged, the more leverage the defense has across the audit, the appeal, and any parallel matters.
5,000+Matters handled
2,500+Clients represented
2,000+Audits overseen
ImmediateAttorney response
Health Law Alliance
Book a Free Consultation
Speak with an experienced attorney today at no cost - evaluate your situation and learn how we can help. Confidential, no obligation.
